topic Re: Access to PA-200 Web GUI is Denied. in General Topics

Access to PA-200 Web GUI is Denied.

Omni918 — Sat, 07 May 2022 00:21:10 GMT

I get access denied message with You dont have authorization to view this page.

I have logged into this firewall many times before but have not for several months now.

I can use putty to get into the console. I found some online solution that would give this error is I was out of space.

My root partition was at 95%. I was able to get it to 93 but not any lower. Not sure what else I can delete but that did not resolve this issue.

I started looking at the certificates and followed other instructions on generating a new SSL cert but that also did not resolve the issue.

Not sure what else I can look at to fix this issue.

Re: Access to PA-200 Web GUI is Denied.

KieraMitchell — Sat, 07 May 2022 08:39:33 GMT

What version of PAN-OS is the PA-200 running? Sounds like either the authentication or apache processes have done an oops (probably the latter, since you can auth via CLI). You can either restart them individually;

"How to Restart the Web-related Processes" - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POIHCA4

Or, I'd recommend just restarting the whole management server:

"How to Restart the Management server "mgmtsrvr" Process" - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaGCAS

If that doesn't help, reboot the box.

Re: Access to PA-200 Web GUI is Denied.

Omni918 — Thu, 12 May 2022 05:13:30 GMT

Sadly that did not fix the issue. Since I cant get in to see what version I have I believe it is 8.x. What is odd is that the documentation shows you should see a process for web_backend, but it looks like that has been replaced with webapp but not sure. Cannot find how to reset certificate on the PA since I think this is my issue. Only one computer gives me this access denied error. All other when I try to go the the browser IP, I get site cannot be found.

Re: Access to PA-200 Web GUI is Denied.

KieraMitchell — Thu, 12 May 2022 08:11:54 GMT

Interesting - to clarify, did you end up rebooting the box?

You should be able to get into the CLI and remove the SSL/TLS Service Profile that's applied to the management interface - it'll then start using the built-in self-signed webgui certificate.

Since it sounds like you can get into the console, you can just run "show system info" to get the PAN-OS version and other key details.

Failing everything, if you can console in you can save a named config version, export it via SCP or TFTP, and factory reset the box (though there are various things you can try before then).

Re: Access to PA-200 Web GUI is Denied.

OtakarKlier — Thu, 12 May 2022 17:10:04 GMT

Hello,

Have you tried a different browser, such as IE?

Regards,

Re: Access to PA-200 Web GUI is Denied.

Omni918 — Mon, 16 May 2022 14:21:19 GMT

I have. Different computers as well.

Re: Access to PA-200 Web GUI is Denied.

Omni918 — Mon, 16 May 2022 14:45:30 GMT

8.1.7. I looked for the command to find the name of the profile but not luck. Only other command I ran that also did not fix it is 'debug system ssh-key-reset management'

Re: Access to PA-200 Web GUI is Denied.

Omni918 — Mon, 16 May 2022 16:40:33 GMT

I believe its a certificate issue on the PA. Since I only have
console access, I'm looking for the command to renew the certificate. I
would think that the PA would auto update if the date on the cert expires
or at least warn me that its expired.

Re: Access to PA-200 Web GUI is Denied.

BPry — Mon, 16 May 2022 21:35:11 GMT

@Omni918,

The firewall will warn you about expiring certificates as an informational system log 15 days prior to the expiration if you have it enabled. Being an informational warning, you'd probably want to setup log forwarding for that particular event since most people wouldn't monitor informational logs.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POWJCA4&lang=en_US%E2%80%A9

Re: Access to PA-200 Web GUI is Denied.

PavelK — Mon, 16 May 2022 22:41:07 GMT

Sorry to suddenly jump into this discussion. I have enabled: "Certificate Expiration Check" on all Firewalls (Pushed globally by Panorama), however I have never seen any log generated even though the certificate already expired, so last year I have opened a TAC case. TAC engineer was able to reproduce the issue and escalated this to engineering team. After approximately half year of waiting, I got this reply:

"I have got an update from our engineering. Your reported issue was marked as an enhancement request. We will not change the current behavior as a bug. If you want to request us to change this behavior to your expectation, please contact our account team to submit a Feature Request."

Based on my experience, there is a chance that feature: Certificate Expiration Check might not work as expected.

Kind Regards

Pavel

Re: Access to PA-200 Web GUI is Denied.

Omni918 — Tue, 17 May 2022 14:09:20 GMT

I have been fighting with this for a month now. I'm just going to do a factory reset and start all over and hopefully that works. I have rebooted this a dozen times and it takes 17 min to come back up and during that time, I have no internet access. So, I will wait for the weekend when no one needs it and try then. I appreciate all the advice and suggestions on this issue. Thanks again for your help. Your awesome!